diff options
| author | Ion Jaureguialzo Sarasola <ion@jaureguialzo.com> | 2021-07-15 20:19:39 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-07-15 20:19:39 +0200 |
| commit | 251d7f524aa53ec1082cacbf8beb4b83446eb7b5 (patch) | |
| tree | 07e5dbfc0b728c5786585213dcfa673fa9517e9d /routers/api | |
| parent | ff69dfff7a6f0b200b5b8a15042894662a19221a (diff) | |
| download | gitea-251d7f524aa53ec1082cacbf8beb4b83446eb7b5.tar.gz gitea-251d7f524aa53ec1082cacbf8beb4b83446eb7b5.zip | |
Check user instead of organization when creating a repo from a template via API (#16346)
* Check user instead of organization
* Enforce that only admins can copy a repo to another user
Diffstat (limited to 'routers/api')
| -rw-r--r-- | routers/api/v1/repo/repo.go | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/routers/api/v1/repo/repo.go b/routers/api/v1/repo/repo.go index b671ef2435..5e0228fdbe 100644 --- a/routers/api/v1/repo/repo.go +++ b/routers/api/v1/repo/repo.go @@ -374,16 +374,21 @@ func Generate(ctx *context.APIContext) { ctxUser := ctx.User var err error if form.Owner != ctxUser.Name { - ctxUser, err = models.GetOrgByName(form.Owner) + ctxUser, err = models.GetUserByName(form.Owner) if err != nil { - if models.IsErrOrgNotExist(err) { + if models.IsErrUserNotExist(err) { ctx.JSON(http.StatusNotFound, map[string]interface{}{ - "error": "request owner `" + form.Name + "` is not exist", + "error": "request owner `" + form.Owner + "` does not exist", }) return } - ctx.Error(http.StatusInternalServerError, "GetOrgByName", err) + ctx.Error(http.StatusInternalServerError, "GetUserByName", err) + return + } + + if !ctx.User.IsAdmin && !ctxUser.IsOrganization() { + ctx.Error(http.StatusForbidden, "", "Only admin can generate repository for other user.") return } |